TCC Bypass via Mounted APFS Snapshot Access
Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC).
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/01/04"
3integration = ["endpoint"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2023/06/22"
8
9[rule]
10author = ["Elastic"]
11description = """
12Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots
13as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file
14system, including all user data and files protected by Apple’s privacy framework (TCC).
15"""
16from = "now-9m"
17index = ["auditbeat-*", "logs-endpoint.events.*"]
18language = "kuery"
19license = "Elastic License v2"
20name = "TCC Bypass via Mounted APFS Snapshot Access"
21references = ["https://theevilbit.github.io/posts/cve_2020_9771/"]
22risk_score = 73
23rule_id = "b00bcd89-000c-4425-b94c-716ef67762f6"
24severity = "high"
25tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Use Case: Vulnerability", "Data Source: Elastic Defend"]
26timestamp_override = "event.ingested"
27type = "query"
28
29query = '''
30event.category:process and host.os.type:macos and event.type:(start or process_started) and process.name:mount_apfs and
31 process.args:(/System/Volumes/Data and noowners)
32'''
33
34
35[[rule.threat]]
36framework = "MITRE ATT&CK"
37[[rule.threat.technique]]
38id = "T1006"
39name = "Direct Volume Access"
40reference = "https://attack.mitre.org/techniques/T1006/"
41
42
43[rule.threat.tactic]
44id = "TA0005"
45name = "Defense Evasion"
46reference = "https://attack.mitre.org/tactics/TA0005/"
References
Related rules
- Attempt to Disable Gatekeeper
- Attempt to Install Root Certificate
- Attempt to Remove File Quarantine Attribute
- Attempt to Unload Elastic Endpoint Security Kernel Extension
- Creation of Hidden Launch Agent or Daemon